AWS Parameter Store: Different keys for different environments

user_1560231 0
Viewed 486

We're trying to move some keys and secrets from .env to AWS Parameter Store for better security. We have two EC2 instances, one for production env and another one for staging env. Each instance has keys/values defined in .env file below public folder, so it's hidden from public access.

Keys in .env file are identical between production and staging env, just values are different. So the code to load these values were the same between production and staging. Now that we're trying to move these keys/values to AWS Paramter Store, and since Parameter Store is account level scope,

Is there a way to assign different values based on EC2 instance?

e.g.

secret = getSecretFromEnv('MY_KEY'); // different values are loaded depending on EC2 instance

has become (what we're trying to avoid doing)

if prod {
   secret = getSecureParameterFromAws('MY_PROD_KEY');
} else {
   secret = getSecureParameterFromAws('MY_STAGING_KEY');
}
aws-parameter-store amazon-web-services
1 Answers

There's two aspects here:

  • Knowing which environment to use
  • Restricting the environment that can be used

If the Production and Test systems are in separate AWS Accounts, then they can access parameters with the same key, since the values will be different.

If the systems are in the same AWS Account, then the code will need to know its own environment so that it requests the correct parameter (via a different key).

This information could be provided in a configuration file or, if both instances are identical, a Tag could be added to the instance. The code could check the tag on its own instance, and then retrieve the appropriate parameters.

This could be further enforced by restricting access to the parameters by assigning different IAM permissions to each instance. This way, the IAM Role is controlling which parameters they can access. The code could attempt to retrieve both parameters and then use whichever one was successfully returned, or the policy could simply be used to ensure that the right parameters are accessed.

user_1747770
Related